mirror of
https://github.com/torvalds/linux.git
synced 2026-11-06 21:58:01 +01:00
60aba79a50
- Leaks
- fix a leak on a rejected string table entry
- fix refcount leak in aa_get_newest_profile()
- fix profile leak when a policy load fails
- remove fs entries created by a failed policy load
- on failed load ensure profile files are removed before parent
- Fix namespace reference leak in __aa_find_or_create_ns()
- Use after free/double free
- fix a use-after-free in aa_lookupn_ns()
- avoid potential double free when remapping DFA tables
- Bounds checking by-passes
- apparmor: fix table_size() integer overflow on 32 bit
- apparmor: check accept index + 1 is in bounds
- Mediation fixes
- Fix AF_UNSPEC mediation
- check address length before reading AF_UNSPEC bind address
- mediate AF_UNSPEC socket disconnects
- Fix sctp connect/bind by-passess
- advertise that sctp is being mediated
- fix check SCTP bind, and connect permission checks
- check connect permission for SCTP
- incorrect state machine traversal
- convert duplicated dfa transitions to match_char()
- locking issues
- don't revalidate inherited files under files->file_lock
- fix uninitialized variable warning in aa_inherit_files
- Bad dereferences
- fix NULL ctx->peer derefs in unix socket ctx updates
- unnecessary warnings
- remove unconfined_profile() check in inet socket mediation
- Kernel Doc
- Fix the return value in split_token_from_name() kernel-doc
- Misc
- fix query_data() output overlapping the lookup key
- report a label allocation failure as -ENOMEM
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE7cSDD705q2rFEEf7BS82cBjVw9gFAmrkwqUACgkQBS82cBjV
w9gTaA//a0x0mMoQxt1/sP6XDC4ud7ywcPqp9veZpV6r0Cek1pYrtSGfoi/uhAau
3gHu/2wR/otchekkK01pYbvhiJysSKCIui/QRBM+gEgBvGzpwDC1IyqhW1vdjGIQ
T4eNgmEWVvK1wMDfZXBLDGHuEiE/XWPxtMFWbd1ZUWD9+jMG2ZOtkOlUgSg/ViJY
V/5+UjKD8VlrmTU6HVTnLl3R39BXCdSfHkHVR8/O7+CDkOyAx9XLj7r7sYhenUIQ
kl09aNE3pTrMu0JEPP7tWl/pEJMssYctR/Q5Q+9hrNRvEH8K/tUzEMaRlxv5rxu1
Z4tfwRMNuNhGJxRABp8un8vcuPtsnaKEnp1zbzkhNZj/fGsF2LySEapXPCuiq1Sh
dlQc3lOPIHYE2Q71IS/vZ9+1pZ4N+IreuKtPIVnxPQq5RYWHRp7drbXfsHpCaUqt
PXaLXENW8eF7v7y+UJEIztyOI4wyFOM3BpblFrJxSHArcHzI/StPnMZv10yx5PqX
kgwymScmi2hyhehrHqSzWbW2GmJLwvF1un7Lk/GRNrvWytAs/1hJIr6N7/ov/NEu
NVDCi3lN+M2e2c0/dWuwg/Kn1nEo7vVMRNlbdXJHXfxDDZgaZQCGagibVcgmPk9i
KvmVQtlnUvf4LiABC/efDvGkxMeR3+JHjVrxS7s1DIKy1fFSIWU=
=MAYC
-----END PGP SIGNATURE-----
Merge tag 'apparmor-pr-2026-10-29' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor
Pull AppArmor fixes from John Johansen:
"Leaks:
- fix a leak on a rejected string table entry
- fix refcount leak in aa_get_newest_profile()
- fix profile leak when a policy load fails
- remove fs entries created by a failed policy load
- on failed load ensure profile files are removed before parent
- Fix namespace reference leak in __aa_find_or_create_ns()
Use after free/double free:
- fix a use-after-free in aa_lookupn_ns()
- avoid potential double free when remapping DFA tables
Bounds checking by-passes:
- fix table_size() integer overflow on 32 bit
- check accept index + 1 is in bounds
Mediation fixes:
- Fix AF_UNSPEC mediation
- check address length before reading AF_UNSPEC bind address
- mediate AF_UNSPEC socket disconnects
- Fix sctp connect/bind by-passess
- advertise that sctp is being mediated
- fix check SCTP bind, and connect permission checks
- check connect permission for SCTP
- incorrect state machine traversal
- convert duplicated dfa transitions to match_char()
- locking issues
- don't revalidate inherited files under files->file_lock
- fix uninitialized variable warning in aa_inherit_files
- Bad dereferences
- fix NULL ctx->peer derefs in unix socket ctx updates
Unnecessary warnings:
- remove unconfined_profile() check in inet socket mediation
Kernel Doc:
- Fix the return value in split_token_from_name() kernel-doc
Misc:
- fix query_data() output overlapping the lookup key
- report a label allocation failure as -ENOMEM"
* tag 'apparmor-pr-2026-10-29' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor: (23 commits)
apparmor: fix uninitialized variable warning in aa_inherit_files
apparmor: fix profile leak when a policy load fails
apparmor: on failed load ensure profile files are removed before parent
apparmor: remove fs entries created by a failed policy load
apparmor: fix query_data() output overlapping the lookup key
apparmor: advertise that sctp is being mediated
apparmor: fix check SCTP bind, and connect permission checks
apparmor: check connect permission for SCTP
apparmor: fix a use-after-free in aa_lookupn_ns()
apparmor: Fix namespace reference leak in __aa_find_or_create_ns()
apparmor: check accept index + 1 is in bounds
apparmor: Fix the return value in split_token_from_name() kernel-doc
apparmor: convert duplicated dfa transitions to match_char()
apparmor: fix table_size() integer overflow on 32 bit
apparmor: avoid potential double free when remapping DFA tables
apparmor: report a label allocation failure as -ENOMEM
apparmor: fix a leak on a rejected string table entry
apparmor: remove unconfined_profile() check in inet socket mediation
apparmor: fix refcount leak in aa_get_newest_profile()
apparmor: check address length before reading AF_UNSPEC bind address
...
|
||
|---|---|---|
| .. | ||
| apparmor | ||
| bpf | ||
| integrity | ||
| ipe | ||
| keys | ||
| landlock | ||
| loadpin | ||
| lockdown | ||
| safesetid | ||
| selinux | ||
| smack | ||
| tomoyo | ||
| yama | ||
| commoncap_test.c | ||
| commoncap.c | ||
| device_cgroup.c | ||
| inode.c | ||
| Kconfig | ||
| Kconfig.hardening | ||
| lsm_audit.c | ||
| lsm_init.c | ||
| lsm_notifier.c | ||
| lsm_syscalls.c | ||
| lsm.h | ||
| Makefile | ||
| min_addr.c | ||
| security.c | ||